制作证书链并进行验证

最新推荐文章于 2025-10-02 04:21:51 发布

原创最新推荐文章于 2025-10-02 04:21:51 发布 · 971 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#ssl #https #服务器

本文详细介绍了如何生成自签名的根证书、中间证书以及叶子证书，并通过openssl工具进行证书链验证，确保服务器HTTPS安全通信。

生成自签名的根证书：

openssl req -x509 -newkey rsa -outform PEM -out tls-rootca.pem -keyform PEM -keyout tls-rootca.key.pem -days 35600 -nodes -subj “/C=cn/O=mycomp/OU=mygroup/CN=rootca”

生成中间证书

1.生成csr和key文件

openssl req -newkey rsa:2048 -outform PEM -out tls-intermca.csr -keyform PEM -keyout tls-intermca.key.pem -nodes -extensions v3_ca -config /etc/ssl/openssl.cnf -subj “/C=cn/O=mycomp/OU=mygroup/CN=intermca”

2.用rootCA对intermca进行签发

openssl x509 -req -days 365 -in tls-intermca.csr -out tls-intermca.pem -CA tls-rootca.pem -CAkey tls-rootca.key.pem -CAcreateserial -extensions v3_ca -extfile /etc/ssl/openssl.cnf

生成叶子证书：

1.生成csr和key文件

openssl req -newkey rsa:2048 -outform PEM -out tls-cert.csr -keyform PEM -keyout tls-cert.key.pem -nodes -reqexts SAN -extensions v3_req -config <(cat /etc/ssl/openssl.cnf <(printf “\n[SAN]\nsubjectAltName=DNS:server.mycomp.com, DNS:localhost, DNS:127.0.0.1”)) -subj “/C=cn/O=mycomp/OU=mygroup/CN=server”

2.用intermca对cert进行签发

openssl x509 -req -days 365 -in tls-cert.csr -out tls-cert.pem -CA tls-intermca.pem -CAkey tls-intermca.key.pem -CAcreateserial -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf “\n[SAN]\nsubjectAltName=DNS:server.mycomp.com, DNS:localhost, DNS:127.0.0.1”))

查看证书：

openssl x509 -in xxx.pem -text -noout

失效中间层证书与根证书验证

~/cert/second-out$ openssl verify -partial_chain -CAfile tls-rootca.pem -untrusted tls-rootca.pem tls-intermca-1.pem
tls-intermca-1.pem: OK

~/cert/second-out$ openssl verify -partial_chain -CAfile tls-rootca.pem -untrusted tls-rootca.pem tls-intermca.pem
tls-intermca.pem: OK

~/cert/second-out$ openssl verify -partial_chain -CAfile tls-rootca.pem -untrusted tls-rootca.pem tls-intermca-out.pem
tls-intermca-out.pem: C = cn, O = mycomp, OU = mygroup, CN = intermca
error 10 at 0 depth lookup:certificate has expired
OK

失效中间层证书与叶子证书

~/cert/second-out$ openssl verify -partial_chain -CAfile tls-intermca-1.pem -untrusted tls-intermca.pem tls-cert.pem
tls-cert.pem: OK

cl@LJY:~/cert/second-out$ openssl verify -partial_chain -CAfile tls-intermca.pem -untrusted tls-intermca.pem tls-cert.pem
tls-cert.pem: OK

~/cert/second-out$ openssl verify -partial_chain -CAfile tls-intermca-out.pem -untrusted tls-intermca.pem tls-cert.pem
tls-cert.pem: C = cn, O = mycomp, OU = mygroup, CN = intermca
error 10 at 1 depth lookup:certificate has expired
OK